"pattern":"[alert tcp any any -> any any ( sid:2000210001; msg:\"P.A.S. webshell - Explorer - download file\"; \\\r\n flow:to_server,established; content:\"POST\"; http_method; \\\r\n content:\"fe=&fdw=%2F\"; http_client_body; offset:0)\r\n\r\nalert tcp any any -> any any ( sid:2000210002; msg:\"P.A.S. webshell - Explorer - copy file\"; \\\r\n flow:to_server,established; content:\"POST\"; http_method; \\\r\n content:\"fe=&fcf=%2F\"; http_client_body; offset:0)\r\n\r\nalert tcp any any -> any any ( sid:2000210003; msg:\"P.A.S. webshell - Explorer - move file\"; \\\r\n flow:to_server,established; content:\"POST\"; http_method; \\\r\n content:\"fe=&fm=%2F\"; http_client_body; offset:0)\r\n\r\nalert tcp any any -> any any ( sid:2000210004; msg:\"P.A.S. webshell - Explorer - del file\"; \\\r\n flow:to_server,established; content:\"POST\"; http_method; \\\r\n content:\"fe=&fd=%2F\"; http_client_body; offset:0)\r\n\r\nalert tcp any any -> any any ( sid:2000210005; msg:\"P.A.S. webshell - Explorer - multi file download\"; \\\r\n flow:to_server,established; content:\"POST\"; http_method; \\\r\n content:\"fe=&fc%5B%5D=%2F\"; http_client_body; offset:0; \\\r\n content:\"&fdwa=Download\"; http_client_body; )\r\n\r\nalert tcp any any -> any any ( sid:2000210006; msg:\"P.A.S. webshell - Explorer - multi file copy\"; \\\r\n flow:to_server,established; content:\"POST\"; http_method; \\\r\n content:\"fe=&fc%5B%5D=%2F\"; http_client_body; offset:0; \\\r\n content:\"&fca=Copy\"; http_client_body;)\r\n\r\nalert tcp any any -> any any ( sid:2000210007; msg:\"P.A.S. webshell - Explorer - multi file move\"; \\\r\n flow:to_server,established; content:\"POST\"; http_method; \\\r\n content:\"fe=&fc%5B%5D=%2F\"; http_client_body; offset:0; \\\r\n content:\"&fma=Move\"; http_client_body; )\r\n\r\nalert tcp any any -> any any ( sid:2000210008; msg:\"P.A.S. webshell - Explorer - multi file delete\"; \\\r\n flow:to_server,established; content:\"POST\"; http_method; \\\r\n content:\"fe=&fc%5B%5D=%2F\"; http_client_body; offset:0; \\\r\n content:\"&fda=Delete\"; http_client_body; ) \r\n\r\nalert tcp any any -> any any ( sid:2000210009; msg:\"P.A.S. webshell - Explorer - paste\"; \\\r\n flow:to_server,established; content:\"POST\"; http_method; \\\r\n content:\"fe=&fbp=Paste\"; http_client_body; offset:0; )]",
"pattern":"[alert tcp any any -> any any ( sid:2000211001; msg:\"P.A.S. webshell - Password cookie\"; \\\r\n flow:established; content:\"g__g_=\"; http_cookie; offset:0; )\r\n \r\nalert tcp any any -> any any ( sid:2000211002; msg:\"P.A.S. webshell - Password form var\"; \\\r\n flow:to_server,established; content:\"POST\"; http_method; \\\r\n content:\"g__g_=\"; http_cookie; http_client_body; offset:0; )]",
"pattern":"[alert tcp any any -> any any ( sid:2000210016; msg:\"P.A.S. webshell - Bind shell session\"; \\\r\n content:\"Hello from P.A.S. Bind Port\"; )\r\n\r\nalert tcp any any -> any any ( sid:2000210017; msg:\"P.A.S. webshell - Reverse shell session\"; \\\r\n content:\"Hello from P.A.S. BackConnect\"; )]",
"pattern":"[file:hashes.MD5 = '92ef0aaf5f622b1253e5763f11a08857' AND file:hashes.SHA1 = 'a739f44390037b3d0a3942cd43d161a7c45fd7e7' AND file:hashes.SHA256 = 'e1ff729f45b587a5ebbc8a8a97a7923fc4ada14de4973704c9b4b89c50fd1146' AND file:name = 'centreon_module_linux_app64']",
"pattern":"[file:hashes.MD5 = '84837778682450cdca43d1397afd2310' AND file:hashes.SHA1 = 'c69db1b120d21bd603f13006d87e817fed016667' AND file:hashes.SHA256 = '893750547255b848a273bd1668e128a5e169011e79a7f5c7bb86cc5d7b2153bc' AND file:name = 'search.php']",
"pattern":"[file:hashes.MD5 = 'a89251cd4c15909a8e15256ead40584e' AND file:hashes.SHA1 = 'b7afb8c91f8f9df4f18764c25251576a0f8bef6f' AND file:hashes.SHA256 = '928d8dde63b0255feffc3d03db30aa76f7ed8913238321cc101083c2c5056ffa' AND file:name = 'DB-Drop.php']",
"pattern":"[file:hashes.MD5 = '9885fcdda12167b2f598b2d22de07d5b' AND file:hashes.SHA1 = '5a58e46e5b8f468445f848f8eca741eddebcef3e' AND file:hashes.SHA256 = 'ebe98d5e1ab6966ec1e292fafbd5ef21c2b15bd7c7bb871d8e756971b8b6877a' AND file:name = '/bin/backup']",
"pattern":"/* configuration file */\r\n\r\nrule exaramel_configuration_key {\r\n\r\n\tmeta:\r\n\t\tauthor = \\\\\"FR/ANSSI/SDO\\\\\"\r\n\t\tdescription = \\\\\"Encryption key for the configuration file in sample e1ff72[...]\\\\\"\r\n\t\tTLP = \\\\\"White\\\\\"\r\n\r\n\tstrings:\r\n\t\t$ = \\\\\"odhyrfjcnfkdtslt\\\\\"\r\n\r\n\tcondition:\r\n\t\tall of them\r\n}\r\n\r\nrule exaramel_configuration_name_encrypted {\r\n\r\n\tmeta:\r\n\t\tauthor = \\\\\"FR/ANSSI/SDO\\\\\"\r\n\t\tdescription = \\\\\"Name of the configuration file in sample e1ff72[...]\\\\\"\r\n\t\tTLP = \\\\\"White\\\\\"\r\n\r\n\tstrings:\r\n\t\t$ = \\\\\"configtx.json\\\\\"\r\n\r\n\tcondition:\r\n\t\tall of them\r\n}\r\n\r\nrule exaramel_configuration_file_plaintext {\r\n\r\n\tmeta:\r\n\t\tauthor = \\\\\"FR/ANSSI/SDO\\\\\"\r\n\t\tdescription = \\\\\"Content of the configuration file (plaintext)\\\\\"\r\n\t\tTLP = \\\\\"White\\\\\"\r\n\r\n\tstrings:\r\n\t\t$ = /{\\\\\"Hosts\\\\\":\\\\[\\\\\".{10,512}\\\\\"\\\\],\\\\\"Proxy\\\\\":\\\\\".{0,512}\\\\\",\\\\\"Version\\\\\":\\\\\".{1,32}\\\\\",\\\\\"Guid\\\\\":\\\\\"/\r\n\r\n\tcondition:\r\n\t\tall of them\r\n}\r\n\r\nrule exaramel_configuration_file_ciphertext {\r\n\r\n\tmeta:\r\n\t\tauthor = \\\\\"FR/ANSSI/SDO\\\\\"\r\n\t\tdescription = \\\\\"Content of the configuration file (encrypted with key odhyrfjcnfkdtslt, sample e1ff72[...]\\\\\"\r\n\t\tTLP = \\\\\"White\\\\\"\r\n\r\n\tstrings:\r\n\t\t$ = {6F B6 08 E9 A3 0C 8D 5E DD BE D4} // encrypted with key odhyrfjcnfkdtslt\r\n\r\n\tcondition:\r\n\t\tall of them\r\n}\r\n\r\n/* persistence */\r\n\r\nprivate rule exaramel_persistence_file_systemd {\r\n\r\n\tmeta:\r\n\t\tauthor = \\\\\"FR/ANSSI/SDO\\\\\"\r\n\t\tdescription = \\\\\"Beginning of the file /etc/systemd/system/syslogd.service created for persistence with systemd\\\\\"\r\n\t\tTLP = \\\\\"White\\\\\"\r\n\r\n\tstrings:\r\n\t\t$ = /\\\\[Unit\\\\]\\\\nDescription=Syslog daemon\\\\n\\\\n\\\\[Service\\\\]\\\\nWorkingDirectory=.{1,512}\\\\nExecStartPre=\\\\/bin\\\\/rm \\\\-f \\\\/tmp\\\\/\\\\.applocktx\\\\n/\r\n\r\n\tcondition:\r\n\t\tall of them\r\n}\r\n\r\nprivate rule exaramel_persistence_file_upstart {\r\n\r\n\tmeta:\r\n\t\tauthor = \\\\\"FR/ANSSI/SDO\\\\\"\r\n\t\tdescription = \\\\\"Part of the file /etc/init/syslogd.conf created for persistence with upstart\\\\\"\r\n\t\tTLP = \\\\\"White\\\\\"\r\n\r\n\tstrings:\r\n\t\t$ = /start on runlevel \\\\[2345\\\\]\\\\nstop on runlevel \\\\[06\\\\]\\\\n\\\\nrespawn\\\\n\\\\nscript\\\\nrm \\\\-f \\\\/tmp\\\\/\\\\.applocktx\\\\nchdir/\r\n\r\n\tcondition:\r\n\t\tall of them\r\n}\r\n\r\nprivate rule exaramel_persistence_file_systemv {\r\n\r\n\tmeta:\r\n\t\tauthor = \\\\\"FR/ANSSI/SDO\\\\\"\r\n\t\tdescription = \\\\\"Part of the file /etc/init.d/syslogd created for persistence with upstart\\\\\"\r\n\t\tTLP = \\\\\"White\\\\\"\r\n\r\n\tstrings:\r\n\t\t$ = \\\\\"# Short-Description: Syslog service for monitoring \\\\n### END INIT INFO\\\\n\\\\nrm -f /tmp/.applocktx && cd \\\\\"\r\n\r\n\tcondition:\r\n\t\tall of them\r\n}\r\n\r\nrule exaramel_persistence_file {\r\n\r\n\tmeta:\r\n\t\tauthor = \\\\\"FR/ANSSI/SDO\\\\\"\r\n\t\tdescription = \\\\\"File created for persistence. Depends on the environment\\\\\"\r\n\t\tTLP = \\\\\"White\\\\\"\r\n\r\n\tcondition:\r\n\t\texaramel_persistence_file_systemd or exaramel_persistence_file_upstart or exaramel_persistence_file_systemv\r\n}\r\n\r\n/* misc */\r\n\r\nrule exaramel_socket_path {\r\n\r\n\tmeta:\r\n\t\tauthor = \\\\\"FR/ANSSI/SDO\\\\\"\r\n\t\tdescription = \\\\\"Path of the unix socket created to prevent concurrent executions\\\\\"\r\n\t\tTLP = \\\\\"White\\\\\"\r\n\r\n\tstrings:\r\n\t\t$ = \\\\\"/tmp/.applocktx\\\\\"\r\n\r\n\tcondition:\r\n\t\tall of them\r\n}\r\n\r\nrule exaramel_task_names {\r\n\r\n\tmeta:\r\n\t\tauthor = \\\\\"FR/ANSSI/SDO\\\\\"\r\n\t\tdescription = \\\\\"Name of the tasks received by the CC\\\\\"\r\n\t\tTLP = \\\\\"White\\\\\"\r\n\r\n\tstrings:\r\n\t\t$ = \\\\\"App.Delete\\\\\"\r\n\t\t$ = \\\\\"App.SetServer\\\\\"\r\n\t\t$ = \\\\\"App.SetProxy\\\\\"\r\n\t\t$ = \\\\\"App.SetTimeout\\\\\"\r\n\t\t$=\\\
"pattern":"rule PAS_webshell_ZIPArchiveFile {\r\n\r\n meta:\r\n author = \\\\\"FR/ANSSI/SDO\\\\\"\r\n description = \\\\\"Detects an archive file created by P.A.S. for download operation\\\\\"\r\n TLP = \\\\\"White\\\\\"\r\n\r\n strings:\r\n $ = /Archive created by P\\\\.A\\\\.S\\\\. v.{1,30}\\\\nHost: : .{1,200}\\\\nDate : [0-9]{1,2}-[0-9]{1,2}-[0-9]{4}/\r\n\r\n condition:\r\n all of them\r\n}",
"value":"The following indicators, SNORT rules and YARA rules are from ANSSI\u2019s analysis of an intrusion campaign targeting the monitoring software Centreon attributed to the intrusion set Sandworm which resulted in the breach of several French entities. This intrusion campaign is described in the following report CERTFR-2021-CTI-005. These technical elements are provided to help detecting malicious activities in logs, on systems and inside live network trafic. Every detection with these elements cannot be considered as a proof of intrusion and should be investigated to confirm. Some elements are detecting tools shared between several attackers so their detection is not sufficient to link an intrusion to this campaign. ANSSI is interested in every incident discovered and linked to this campaign.",
